Zimbra Collaboration Suite EUVD-2026-101460

Requires a reachable Zimbra Collaboration Suite 10.1.0-10.1.21 instance with the GraphQL authentication interface exposed to the attacker (typically an internet-facing mail/web portal); no credentials or user interaction are needed (PR:N/UI:N). The limiting factor is that this flaw only defeats Zimbra's source-IP failure counter - it does not grant access by itself. An attacker still needs to successfully guess or stuff valid credentials, and defenses such as valid MFA, strong/unique passwords, WAF-level request inspection of GraphQL alias abuse, or restricting portal exposure materially reduce real-world impact.

Signals are mostly low and largely consistent, but the raw CVSS understates the operational risk. The provided CVSS 3.1 base score is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable and unauthenticated, but rated high complexity with only low confidentiality impact. No EPSS score, KEV listing, or POC flag was supplied, so exploitation-probability and active-exploitation signals are absent rather than contradictory. The AC:H rating is questionable: abusing GraphQL aliases to batch authentication attempts is a low-effort, repeatable technique, so the mechanics look closer to AC:L - verify with the Rapid7 research. The core issue is that this is a protection-mechanism failure (CWE-307) rather than a direct compromise: by itself it discloses nothing, but it neutralizes Zimbra's source-IP lockout and turns credential brute-force and password-spraying into a practical attack against exposed mail portals. Net assessment: not an emergency on its own numbers, but a meaningful force-multiplier for account takeover on internet-facing Zimbra, and Zimbra's history as an attacker target raises its practical priority above the 3.7 score.

An unauthenticated attacker targeting an internet-facing Zimbra 10.1.x server sends GraphQL requests that pack many aliased authentication attempts into a single HTTP request, so each request tries numerous passwords without tripping the per-source-IP failure counter. This lets the attacker run large-scale credential stuffing or password spraying against known mailboxes until valid credentials are found. No public exploit identified at time of analysis, though the Rapid7 blog documents the technique.